From: Chris <bsd-lists@bsdforge.com> To: Ed Maste <emaste@freebsd.org> Cc: "Rodney W. Grimes" <freebsd-rwg@gndrsh.dnsmgr.net>, freebsd-net@freebsd.org Subject: Re: Discarding inbound ICMP REDIRECT by default Message-ID: <3c5aeeae30d6b21b8fa408126bf9230c@bsdforge.com> In-Reply-To: <CAPyFy2DmbfYOYvWKm7%2Bfq5RMgM8que6OW7LKJHKoMH=L%2B9-wwg@mail.gmail.com> References: <202406122147.45CLlsgN042313@gndrsh.dnsmgr.net> <72ceb2fe26812a237a17bd8de4024b7f@bsdforge.com> <CAPyFy2DmbfYOYvWKm7%2Bfq5RMgM8que6OW7LKJHKoMH=L%2B9-wwg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 2024-06-14 05:50, Ed Maste wrote: > On Wed, 12 Jun 2024 at 18:05, Chris <bsd-lists@bsdforge.com> wrote: >> >> As Rodeney already effectively explains; dropping packets makes routing, >> and discovery exceedingly difficult. Which is NOT what the average user >> wants, > > This is on end hosts only, not routers (which already drop ICMP REDIRECT). > >> or expects. I use "set block-policy drop" in pf(4). But as already noted, >> this is for "filtering" purposes. Your suggestion also has the negative >> affect >> of hanging remote ports. Which can result in other negative results by >> peers. > > I don't follow -- how does a host not processing ICMP REDIRECT cause > these effects? It appears I may have overstated my point here. Dropping redirects isn't (necessarily) out of line. I was thinking in terms of dropping (all) queries. Which is wrong in this context. Sorry. :) Thanks for taking the time to respond. --Chris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3c5aeeae30d6b21b8fa408126bf9230c>